Password Attacks GPEN Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company wants to defend against both password spraying and credential stuffing. They have a legacy system that cannot support MFA. Which combination of controls is most effective?

   • AIncrease password length to 20 characters and disable lockout.
   • BImplement account lockout after 5 attempts and block known breached passwords.
   • CDeploy a SIEM to monitor logs after the fact.
   • DUse a password history policy and require periodic changes.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A tester is cracking passwords for a domain where the password policy requires 8+ characters, a number, and a symbol. The tester has a wordlist of common words. The tester wants to maximize success while minimizing time. Which strategy is best?

   • ARun a rainbow table attack for the hash type.
   • BRun a hybrid attack appending two digits and a symbol to each word.
   • CRun a dictionary attack with the wordlist as-is.
   • DRun a pure brute-force attack over all 8-character combinations with all printable characters.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A penetration tester wants to crack passwords that are likely based on common English words. Which attack method is most appropriate to start with?

   • APass-the-hash attack
   • BRainbow table attack
   • CBrute-force attack
   • DDictionary attack
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A tester has a list of common passwords and wants to crack hashes that are likely based on simple words. The tester wants to avoid the overhead of generating many mutations. Which attack mode is most direct?

   • ARule-based attack with many rules.
   • BHybrid attack appending two digits to each word.
   • CDictionary attack using the wordlist as-is.
   • DBrute-force attack over all 8-character combinations.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is investigating a series of successful logins to the company's webmail system. The logins used email addresses and passwords that were found in a recent breach of a public forum. Which attack technique does this pattern indicate?

   • APassword spraying, using a few common passwords against many accounts
   • BCredential stuffing, replaying breached username/password pairs
   • CBrute-force, systematically trying all possible passwords
   • DPass-the-hash, using captured hashes to authenticate
   Reveal Solution Discussion Select an answer first